feat(npm): packument GET conditional GET + cache headers (S11 Step 11 part 3/4)

📦 Summary

Part 3 of 4 of the npm hosted packument GET handler (S11 Step 11). Adds conditional GET and cache headers on top of the cache-hit and inline-build paths:

• If-None-Match → 304 Not Modified short-circuit on both serve paths (zero OpenBlob on a cache-hit 304)
• Cache-Control varying by repository visibility (public, max-age=60, stale-while-revalidate=600 for public; private, max-age=0 otherwise)
• Vary: Authorization, Accept
• The matching S11 spec amendment to the packument GET Headers row (the plan-sanctioned vary-by-visibility refinement)

🧪 Tests

Unit: conditional-GET 304 (match / non-match), Cache-Control by visibility (table-driven), Vary header, absolute dist.tarball URL. Integration: cache-served after rebuild, latest omission semantics, force-expire behaviors, anonymous read of a public repo.

🗂️ Stack

Part 3/4, targets 10io/npm-hosted-step11-part2of4 (part 2/4). Part 4 stacks on this.

Related to #129 (closed)

🔗 Stacked MRs (review/merge bottom-up)

• feat(npm): packument GET core serve (S11 Step 1... (!630 - merged) • David Fernandez • 19.2
• feat(npm): packument GET cache-hit serve (S11 S... (!631 - merged) • David Fernandez • 19.2
• feat(npm): packument GET conditional GET + cach... (!632 - merged) • David Fernandez • 19.2 👈
• feat(npm): packument GET inline-build singlefli... (!633 - merged) • David Fernandez • 19.2